<html>
<head><meta charset="utf-8"><title>lint for unconstrained lifetimes in return type · wg-secure-code · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/index.html">wg-secure-code</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/lint.20for.20unconstrained.20lifetimes.20in.20return.20type.html">lint for unconstrained lifetimes in return type</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="183656139"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/lint%20for%20unconstrained%20lifetimes%20in%20return%20type/near/183656139" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/lint.20for.20unconstrained.20lifetimes.20in.20return.20type.html#183656139">(Dec 17 2019 at 15:02)</a>:</h4>
<p>BTW, <span class="user-mention" data-user-id="235180">@Jack Moffitt</span> was telling me recently about a lint that he developed for a specific bug that was found in Libra. I'm not sure whether he's tried to upstream said lint somewhere, but I thought I would raise it here, as I thought some of the folks in this stream would be interested. Maybe <span class="user-mention" data-user-id="235180">@Jack Moffitt</span> can provide more details though =) </p>
<p>Apologies if this is already well known</p>



<a name="183656222"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/lint%20for%20unconstrained%20lifetimes%20in%20return%20type/near/183656222" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/lint.20for.20unconstrained.20lifetimes.20in.20return.20type.html#183656222">(Dec 17 2019 at 15:03)</a>:</h4>
<p>The pattern in question was something like</p>
<div class="codehilite"><pre><span></span><span class="k">fn</span> <span class="nf">foo</span><span class="o">&lt;</span><span class="na">&#39;a</span><span class="o">&gt;</span><span class="p">(</span><span class="n">x</span>: <span class="nc">impl</span><span class="w"> </span><span class="nb">AsRef</span><span class="o">&lt;</span><span class="kt">str</span><span class="o">&gt;</span><span class="w"> </span><span class="o">+</span><span class="w"> </span><span class="na">&#39;a</span><span class="p">)</span><span class="w"> </span>-&gt; <span class="kp">&amp;</span><span class="na">&#39;a</span><span class="w"> </span><span class="kt">str</span><span class="w"></span>
</pre></div>


<p>which <em>looks</em> like the <code>'a</code> in the return type is "constrained" to the lifetime of the data in <code>x</code>, but doesn't actually have that effect all of the time (e.g., <code>x</code> could be a <code>String</code>, in which case any reference to the data in <code>x</code> would be dangling upon return).</p>



<a name="183660817"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/lint%20for%20unconstrained%20lifetimes%20in%20return%20type/near/183660817" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Moffitt <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/lint.20for.20unconstrained.20lifetimes.20in.20return.20type.html#183660817">(Dec 17 2019 at 15:50)</a>:</h4>
<p>I did an audit of the first party unsafe code in libra/libra. I totally missed that the <code>'a</code> in that signature could be unbound, which David Tolnay thankfully caught in this PR: <a href="https://github.com/libra/libra/pull/1949" target="_blank" title="https://github.com/libra/libra/pull/1949">https://github.com/libra/libra/pull/1949</a></p>
<p>After talking with <span class="user-mention" data-user-id="116009">@nikomatsakis</span> I decided to try writing a lint to catch this case. The PR to rust-clippy can be found here: <a href="https://github.com/rust-lang/rust-clippy/pull/4908" target="_blank" title="https://github.com/rust-lang/rust-clippy/pull/4908">https://github.com/rust-lang/rust-clippy/pull/4908</a></p>



<a name="183684876"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/lint%20for%20unconstrained%20lifetimes%20in%20return%20type/near/183684876" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alex Gaynor <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/lint.20for.20unconstrained.20lifetimes.20in.20return.20type.html#183684876">(Dec 17 2019 at 19:53)</a>:</h4>
<p>Awesome! A capacbility it feels like we should have is:<br>
a) The ability to select only clippy "security" lints<br>
b) Something like crater for clippy security lints</p>



<a name="183687673"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/lint%20for%20unconstrained%20lifetimes%20in%20return%20type/near/183687673" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/lint.20for.20unconstrained.20lifetimes.20in.20return.20type.html#183687673">(Dec 17 2019 at 20:24)</a>:</h4>
<p>Many correctness lints already fall into that category. Like pointer casts that violate size or alignment constraints.</p>



<a name="183687780"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/lint%20for%20unconstrained%20lifetimes%20in%20return%20type/near/183687780" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/lint.20for.20unconstrained.20lifetimes.20in.20return.20type.html#183687780">(Dec 17 2019 at 20:25)</a>:</h4>
<p>I expect the deny-by-default lints already encode something similar - critically broken code that should be flat out prohibited</p>



<a name="183687846"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/lint%20for%20unconstrained%20lifetimes%20in%20return%20type/near/183687846" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alex Gaynor <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/lint.20for.20unconstrained.20lifetimes.20in.20return.20type.html#183687846">(Dec 17 2019 at 20:26)</a>:</h4>
<p>The required categorization may already exist, I haven't explored clippy's configuration deeply.</p>



<a name="183687894"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/lint%20for%20unconstrained%20lifetimes%20in%20return%20type/near/183687894" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/lint.20for.20unconstrained.20lifetimes.20in.20return.20type.html#183687894">(Dec 17 2019 at 20:26)</a>:</h4>
<p>I like the idea of rustwide + Clippy deny-by-default lints, I have to admit. <br>
<a href="https://github.com/rust-lang/rustwide" target="_blank" title="https://github.com/rust-lang/rustwide">https://github.com/rust-lang/rustwide</a> makes it pretty easy.</p>



<a name="183688108"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/lint%20for%20unconstrained%20lifetimes%20in%20return%20type/near/183688108" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/lint.20for.20unconstrained.20lifetimes.20in.20return.20type.html#183688108">(Dec 17 2019 at 20:29)</a>:</h4>
<p>yeah really liking Rustwide. It's what I'm using to try to drive reproducible builds</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>